The Turning Gate

Where did my disk space go?

Disappearing disk space in Mac OS X

Taken from the MacFixIt Forums, posted here mainly for my own reference.

Since the introduction of Mac OS X, there have been more frequent reports of hard drive volumes full for reasons not known to their owners, or reports of large amounts of disk space occupied for unknown reasons. This article describes every cause of the “missing disk space problem” I have seen in these forums.

First, make sure that the apparently missing disk space problem is not the result of a disk directory error. Errors in the Volume Bitmap portion of the disk directory, which records which sectors of the disk are free and which ones are occupied by pieces of files, can cause the reported free space to be inaccurate.

To check the disk directory, use Disk Utility while booted from another volume, run fsck in single-user mode, or use a third-party disk repair utility. See Using Disk Utility and fsck for file system maintenance in Mac OS X.

If no disk directory error is found, follow this plan:

If you have either of these third-party products installed, read the relevant articles:

1. If you have used Norton Antivirus for Macintosh version 9.0, the missing disk space may be accounted for by the spacesuckingfile. The Symantec article explains how to find and delete the invisible file, and how to upgrade to a newer version to avoid having this problem later. [Problem may be back in version 10.1.]

2. If you have older Macally iShock game controller device drivers installed, please see Mac OS X 10.3.8: Free disk space disappears after updating to 10.3.8.

In most cases, there really are files occupying part of the volume, but the files are invisible in normal use of the Finder.

Using the Finder’s Go to Folder feature (in the Go menu), look at the sizes of the contents of these folders, by pasting in these pathnames:

/private/var/vm

/private/var/log

/Volumes

The /private/var/vm directory contains the swapfiles used by virtual memory. New ones are made as more data is swapped from RAM to the hard drive. The entire process of creating them begins at each reboot or restart; do not attempt to remove them yourself. Check the total size of all the swapfiles, right after you boot, and as the disk fills up. In Panther, the first two swapfiles are 64MB, then each new one is twice the size of the preceeding one (128MB, 256MB, 512MB, 1 GB) up to a maximum size of 1 GB. In Tiger, the first two swapfiles are 64 MB, the next one is 128 MB, and any additional swapfiles are 256 MB (see this screen capture showing 11 swapfiles in a Tiger system).

If you do not run the daily, weekly, and monthly maintenance scripts (either by using a utility, or by running the commands sudo periodic daily, sudo periodic weekly, and sudo periodic monthly in Terminal), the logs on the startup volume can become too large. If an error is occurring frequently and is being logged, you can have a very large file at /private/var/log/system.log. I recently saw mention of a system.log file that was larger than 40 GB. See http://docs.info.apple.com/article.html?artnum=107388 for Apple’s explanation of the maintenance scripts and what utilities you can use to run them.

The files in /Volumes should be aliases to your mounted volumes. Do not remove these aliases, because anything you do to them happens to the contents of the corresponding volumes. If you are not confident that you can explore this folder without mishap, before you begin, properly unmount any volume other than the startup volume, if the missing disk space problem affects only that volume. External FireWire drives can be disconnected after proper unmounting.

Sometimes, backup programs that cannot find an intended destination (or target) volume for a backup create a folder with the same name as the destination, and put the folder into the /Volumes directory. There are cases in which the entire startup volume has been backed up on itself, in a folder inside /Volumes. If the amount of missing space is about the size of your user folder, such a backup is likely to be the explanation. If you use Carbon Copy Cloner or another backup or cloning utility and have its preferences configured to create a backup on a schedule, and the intended destination volume is not mounted or is sleeping at the scheduled time, the backup is created in the /Volumes directory.

To check the size of the normally invisible /Volumes directory on the active startup volume, open a new Finder window. Select the startup volume in the list at the left, then choose column view (the one at the right of the three views). From the Finder’s Go menu, choose Go to Folder, and paste in:

/Volumes

The /Volumes directory becomes visible in the Finder; find its size by selecting it and typing Command I. My /Volumes directory is reported to be 12K.

Try to determine where your various caches are. There may be files left over from burning CDs or DVDs. The One Step DVD option in iDVD has been reported to leave files in the directory /private/tmp.
The backup utility Retrospect may leave a large file at /Library/Preferences/Retrospect/RetroData.tmp.

WhatSize lists both visible and invisible files and sorts the search results by size. It reports the contents of the various trash directories.

To explore the trash using Terminal:

There may be files in one or both of the Trash directories, despite an apparently empty bin in the Finder. The two directories are:

/.Trashes

at the root level of the disk and

/Users/user_name/.Trash

in your own user folder.

To see the contents of /.Trashes, open Terminal, located in /Applications/Utilities. Type:

cd /.Trashes

Press the Return key, then type:

sudo ls-lias

Press the Return key, and enter your administrative password.

Your session should look like this if your system trash is empty:

MMT3s-Computer:~ MMT3$ cd /.Trashes
MMT3s-Computer:/.Trashes MMT3$ sudo ls -lias
Password:

total 0 19 0 d-wx-wx-wt 3 root admin 102 27 Mar 2004 . 2 0 drwxrwxr-t 54 root admin 1836 26 Feb 12:56 ..
399372 0 drwx——— 2 MMT3 admin 68 27 Mar 2004 501

Now, explore your user Trash. Type:

cd ~/.Trash

Press Return. Then type:

ls -lias

Press Return.

Your session should look like this if your user Trash is empty:

MMT3s-Computer:/.Trashes MMT3$ cd ~/.Trash
MMT3s-Computer:~/.Trash MMT3$ ls -lias
total 16 377779 0 drwx——— 3 MMT3 MMT3 102 26 Feb 09:44 . 377615 0 drwxr-xr-x 38 MMT3 MMT3 1292 31 Jan 00:32 ..
3092148 16 rw——— 1 MMT3 MMT3 6148 26 Feb 09:44 .DS_Store
MMT3s-Computer:~/.Trash MMT3$

Please see Why Defrag? for a description of the possible consequences (irreparable disk directory damage) of having any HFS+ volume too full, and the importance of having sufficient disk space that is both free and contiguous on each volume. The free space should be a minimum of 15%.

MicroMat Inc
Makers of TechTool

Send this article to a friend »

« Next Article | ... ... | Previous Article »